Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
118 detections
Filters
Last updated
All Time
Detection languages
117
1
Contributors
52
30
22
5
3
Categories
98
67
61
26
22
Platforms
102
27
19
6
6
Products / Services
113
102
14
3
2
MITRE Techniques
67
39
37
29
28
CVEs
4
4
3
2
1
IDS Classtypes
1,937
503
461
381
236
118
IDS Protocols
64
44
4
2
2
Detects high-volume, threshold-based scanning/exploitation attempts against the WordPress REST API batch endpoint from a single source, consistent with mass wp2shell PoC-driven exploitation.
Detects network traffic attempting to access sensitive Windows Registry keys (SAM, SECURITY, LSA Secrets, winlogon DefaultPassword) over the SMB protocol, which is indicative of credential harvesting activities.
This rule detects mass scanning activity targeting FortiGate SSL VPN login endpoints on non-standard HTTPS ports (4433, 4443, 8443, 9443, 10443, 541). It specifically looks for HTTP requests containing '/login' in the URI, indicating an attempt to find or interact with the VPN login page. The rule uses a threshold to identify mass scanning, triggering an alert if a source IP makes 10 or more such requests within 60 seconds.
Detects repeated RDP connection attempts to port 3389 from a single source within a short timeframe, characteristic of brute force or password spraying activity. The rule monitors for consecutive TLS ClientHello or MCS Connect-Initial packets.
Detects high-frequency TCP SYN scanning behavior targeting Telnet (port 23) and SSH (port 22) ports, characteristic of Mirai botnet propagation and reconnaissance activities.
Detects network traffic attempting to access sensitive Windows Registry keys (SAM, SECURITY, LSA Secrets, winlogon DefaultPassword) over the SMB protocol, which is indicative of credential harvesting activities.
This rule detects high-volume HTTP POST requests to the FortiGate SSL VPN logincheck URI, specifically '/remote/logincheck', over common HTTPS ports (443, 4433, 8443, 9443, 10443). It uses a threshold of 5 requests from the same source IP within 30 seconds to identify potential credential stuffing or password spraying attacks against FortiGate devices, often associated with the 'FortiBleed' campaign.
Detects repeated RDP connection attempts to port 3389 from a single source within a short timeframe, characteristic of brute force or password spraying activity. The rule monitors for consecutive TLS ClientHello or MCS Connect-Initial packets.
Detects high-frequency TCP SYN scanning behavior targeting Telnet (port 23) and SSH (port 22) ports, characteristic of Mirai botnet propagation and reconnaissance activities.
Detects possible TCP SYN port scanning activity by identifying a high volume of SYN packets from a single source within a short time window, which is commonly associated with reconnaissance tools like Nmap.
Stealth TCP SYN Scan Detected
Suricata
Detects low-and-slow TCP SYN scanning activity where an attacker reduces scan rate to avoid basic threshold detection. This is common in stealth reconnaissance using Nmap or custom scanners.
Detects HTTP requests with known scanner or automation user-agents commonly used by reconnaissance tools like Nikto, sqlmap, or curl-based scripts. This rule specifically looks for 'sqlmap', 'nikto', 'curl', and 'python-requests' within the HTTP User-Agent header.
Detects high-volume vulnerability and spyware threat activity originating from external (UNTRUSTED) sources targeting public-facing IP addresses.
This detection identifies potential exploitation attempts, scanning activity, and malicious payload delivery by monitoring PAN-OS threat logs where severity is not informational and the subtype indicates vulnerability or spyware.
The rule triggers when:
A source IP generates ≥100 reset-both actions within 1 hour (indicative of blocked exploit or aggressive scanning), or
A source IP generates ≥10 non-reset actions within 1 hour (indicative of potentially successful or partially successful attempts)
Enrichment includes ASN, country, organization, and city to support attribution, threat hunting, and blocking decisions.
This detection identifies potential exploitation attempts, scanning activity, and malicious payload delivery by monitoring PAN-OS threat logs where severity is not informational and the subtype indicates vulnerability or spyware.
The rule triggers when:
A source IP generates ≥100 reset-both actions within 1 hour (indicative of blocked exploit or aggressive scanning), or
A source IP generates ≥10 non-reset actions within 1 hour (indicative of potentially successful or partially successful attempts)
Enrichment includes ASN, country, organization, and city to support attribution, threat hunting, and blocking decisions.
Page 6 of 6